Remove Windows Troubles Solver (Uninstall Guide)

What is Windows Troubles Solver ?

Windows Troubles Solver is a fake rogue anti-spyware program
that is part of the Fake
Microsoft Security Essentials infection. When this infection is installed
on your computer it will display a fake Microsoft Security Essentials alert
that states that it has detected an Unknown Win32/Trojan on
your computer. This alert will state:

It will then prompt you to scan your computer, which will start a fake scan
of your computer that ultimately states that a particular file is infected with
Trojan.Horse.Win32.PAV.64.a. It will then prompt you to install
Windows Troubles Solver to remove the virus. The text of this prompt is:

Threat prevention solution found
Security system analysis has revealed critical file system vulnerability caused
by severe malware attacks.
Risk of system files infection:
The detected vulnerability may result in unauthorized access to private information
and hard drive data with a serious possibility of irreversible data loss and
unstable PC performance. To remove the malware please run a full system scan.
Press 'OK' to install the software necessary to initiate system files check.
To complete the installation process please reboot your computer.

When you press OK, the infection will download and install Windows Troubles Solver and reboot your computer.

When your computer reboots you will be presented with the Windows Troubles Solver screen before your normal Windows desktop is shown. It then prompts you
to scan your computer, which will state that your computer is infected with
numerous infections. In order to get to your normal Windows desktop, you will
need to close the Windows Troubles Solver program when it has finished its
fake scan. As you can see this program is a scam as it is ransoming the proper
operation of your computer until you purchase it. It goes without saying that
you should not purchase this program for any reason.

While the program is running it will also display fake security alerts that
are further used to scare you into thinking that your computer has a serious
problem. Some of these alerts include:

Just like the fake scan results, these alerts are also fake and are only being
used to scare you into purchasing the program. Therefore, please ignore them.

As you can see, Windows Troubles Solver was created to scare you into thinking
your computer has a severe security problem so that you will then purchase this
program. For no reason should you purchase Windows Troubles Solver , and
if you already have, you should contact your credit card company and dispute
the charges stating that the program is a computer infection. Finally, to remove
this infection, and any related malware, please use the removal guide below.

Windows Troubles Solver Removal Options

Self Help Guide

This guide contains advanced information, but has been written in such a way so that anyone can follow it. Please ensure your data is backed up before proceeding. If you are uncomfortable making changes to your computer or following these steps, do not worry! Instead you can get free one-on-one help by asking in the forums.

Print out these instructions as we may need to close every window that is
open later in the fix.

It is possible that the infection you are trying to remove will not allow
you to download files on the infected computer. If this is the case, then
you will need to download the files requested in this guide on another computer
and then transfer them to the infected computer. You can transfer the files
via a CD/DVD, external drive, or USB flash drive.

The
Windows Troubles Solver
infection will start before your normal Windows desktop appears.
To access your desktop we first need to allow it to perform it's fake scan.
Therefore, when it tells you that it must perform a scan press the OK
button to allow it to do so.
Windows Troubles Solver
will now perform a fake scan and when it is finished it will state that numerous infections were found and then prompt you to fix the errors. Press the Fix Errors button and you will now be at the Update Manager screen.
At this screen you can close the program by clicking on
the X at the top right of the
Windows Troubles Solver
Window. Shown below is an image of the program screen that shows
the location of the X, designated by the black arrow, that
you should click on to close the program. Once you close the program, your
Windows Desktop will load normally.

Now that your Windows Desktop is available, we can continue with the rest
of the removal process.

Before we continue we should also terminate the
Windows Troubles Solver
infection so that it does not interfere with the cleaning procedure. To do
this, please download RKill to your desktop from the following link.

When at the download page, click on the Download Now button
labeled iExplore.exe download link. When you are prompted
where to save it, please save it on your desktop.

Once it is downloaded, double-click on the iExplore.exe
icon in order to automatically attempt to stop any processes associated with
Windows Troubles Solver
and other Rogue programs. Please be patient while the program looks for various
malware programs and ends them. When it has finished, the black window will
automatically close and you can continue with the next step. If you get a
message that RKill is an infection, do not be concerned. This message is just
a fake warning given by
Windows Troubles Solver
when it terminates programs that may potentially remove it. If you run into
these infections warnings that close RKill, a trick is to leave the warning
on the screen and then run RKill again. By not closing the warning, this typically
will allow you to bypass the malware trying to protect itself so that RKill
can terminate
Windows Troubles Solver
. So, please try running RKill until the malware is no longer running. You
will then be able to proceed with the rest of the guide. Do not reboot
your computer after running RKill as the malware programs will start again.

If you continue having problems running RKill, you can download the
other renamed versions of RKill from the RKill
download page. All of the files listed there are renamed copies of RKill,
which you can try instead. Please note that the download page will open in
a new browser window or tab.

Next we have to do is fix your Windows Registry Shell value. If we do not
fix this entry and
is deleted, then your Windows desktop will not be displayed the next time
you reboot.

To fix the Shell entry, simple download the following file to your desktop.
If you are having trouble downloading the file, try right-clicking on it and
selecting Save as.

Once Shell.reg has been downloaded, locate it on your desktop and double-click
on it. When Windows asks if you would like the data to be merged, please allow
it to do so.

At this point you should download Malwarebytes Anti-Malware, or MBAM, to scan your computer for any any infections or adware that may be present. Please download Malwarebytes from the following
location and save it to your desktop:

Once downloaded, close all programs and Windows on your computer, including
this one.

Double-click on the icon on your desktop named mbam-setup-bc.1878-2.2.1.1043.exe.
This will start the installation of MBAM onto your computer.

When the installation begins, keep following the prompts in order to continue
with the installation process. Do not make any changes to default settings
and when the program has finished installing, make sure you leave Launch
Malwarebytes Anti-Malware checked. Then click on the Finish button. If MalwareBytes prompts you to reboot, please do not do so.

MBAM will now start and you will be at the main screen as shown below.

Please click on the Scan Now button to start the scan. If there is an update available for Malwarebytes it will automatically download and install it before performing the scan.

MBAM will now start scanning your computer for malware. This process can
take quite a while, so we suggest you do something else and periodically
check on the status of the scan to see when it is finished.

When MBAM is finished scanning it will display a screen that displays any malware that it has detected. Please note that the infections found may be different
than what is shown in the image below due to the guide being updated for newer versions of MBAM.

You should now click on the Remove Selected button to remove
all the seleted malware. MBAM will now delete all of the files and registry
keys and add them to the programs quarantine. When removing the files, MBAM
may require a reboot in order to remove some of them. If it displays a message
stating that it needs to reboot, please allow it to do so. Once your computer
has rebooted, and you are logged in, please continue with the rest of the
steps.

You can now exit the MBAM program.

As many rogues and other malware are installed through vulnerabilities found
in out-dated and insecure programs, it is strongly suggested that you use
Secunia PSI to scan for vulnerable programs on your computer. A tutorial on
how to use Secunia PSI to scan for vulnerable programs can be found here:

%UserProfile% refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> for Windows 2000/XP, C:\Users\<Current User> for Windows Vista/7/8, and c:\winnt\profiles\<Current User> for Windows NT.